MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4809d8a82fe59341d61df78698ff1ebd502ed4c4e7cc7d779b6f434508c1c204. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4809d8a82fe59341d61df78698ff1ebd502ed4c4e7cc7d779b6f434508c1c204
SHA3-384 hash: a86e966f4c680fa87d60a40e60a48028a37b61eef44812ceaa7cb5167d899b3478767c7bd9af9bea7a805d5208c10379
SHA1 hash: 5fd71262d04419b0d6c43edbb7e7eb346889e50e
MD5 hash: 863cf652ff99523fc31fd4c10b53bee8
humanhash: cold-low-freddie-yellow
File name:Inquiry no 3308.ARJ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:723'604 bytes
First seen:2021-03-25 06:38:19 UTC
Last seen:2021-03-25 06:39:06 UTC
File type: arj
MIME type:application/x-rar
ssdeep 12288:iNfbP1LBSVGyX8fu4gCWaNuVrh3/HwEuNrpfjDSDSAyRjrwXQG7LIey6:qb99WF/4grpVvarFkSNgXQGvk6
TLSH 0BF423F7EE8CF5E9E1F8F159B7622F36569315BA938E218D6324A72BE994DC12530000
Reporter cocaman
Tags:AgentTesla arj


Avatar
cocaman
Malicious email (T1566.001)
From: "Steven.Rees@emerson.com" (likely spoofed)
Received: "from emerson.com (unknown [185.222.57.157]) "
Date: "24 Mar 2021 16:46:13 -0700"
Subject: "Order Enquiry No: 3308"
Attachment: "Inquiry no 3308.ARJ"

Intelligence

File Origin
# of uploads :
3
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4809d8a82fe59341d61df78698ff1ebd502ed4c4e7cc7d779b6f434508c1c204/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-03-24 21:33:42 UTC
File Type:
Binary (Archive)
Extracted files:
37
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jae5rkbp4wjudvq566djr7y6xvic5vge47gh2543n5bukcgbyica._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Gamarue
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4809d8a82fe59341d61df78698ff1ebd502ed4c4e7cc7d779b6f434508c1c204

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 4809d8a82fe59341d61df78698ff1ebd502ed4c4e7cc7d779b6f434508c1c204

(this sample)

AgentTesla

Executable exe dd5488899a4241db6238cf4901132bd368c9de0efc64350a1ea6b8d555d9ca62

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dd5488899a4241db6238cf4901132bd368c9de0efc64350a1ea6b8d555d9ca62
  
Dropping
AgentTesla

Comments